(CVE-2023-32784)[Credential Dumping] KeePass information disclosure (Password Recovery)

KeePass could allow a local attacker to obtain sensitive information, caused by a flaw when performing memory dump. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain master password from a memory dump, and use this information to launch further attacks against the affected system.

It doesn’t matter where the memory comes from – can be the process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), various crash dumps or RAM dump of the entire system. It doesn’t matter whether or not the workspace is locked. It is also possible to dump the password from RAM after KeePass is no longer running, although the chance of that working goes down with the time it’s been since then.

Requirements

KeePass 2.23 or earlier
Dump file (memory dump)
a .kdbx file (database)

Affected Products

KeePass KeePass 2.53

Lab

1. Create a DUMP file by opening task manager and right clicking on KeePass process, Create dumpfile

Exploitation

1. Having a Dump file from KeePass 2.53 version we can run the script https://github.com/vdohney/keepass-password-dumper?tab=readme-ov-file, Download this tool as ZIP into a Windows machine

2. Extract the file from the Zip file

3. Run the program and indicate the dump file location, or copy the file within the same directory of the script

dotnet run G:\Users\Desktop\KeePass.DMP

4. After the script completes you will have a close or complete password. In this case the password was helloworld, it got elloworld, as you can see the descending lines from 2 to 10.

5. Then you can test importing and opening the file in KeyPass

File -> Import
Select the format KeePass KDBX (2.x)
Select the file from the folder (it has to be a .kdbx format
Click OK
Enter the Password

Note, you can also search on the internet for some common words, pasting the result into a web browser, it may correct you. Try upper and lower case combinations.

Remedy

Upgrade to the latest version of KeePass (2.54 or later), available from the SourceForge KeePass Project Web site.

if you’ve been using KeePass for a long time, your master password (and potentially other passwords) could be in your pagefile/swapfile, hibernation file and crash dump(s). Depending on your paranoia level, you can consider these steps to resolve the issue:

Change your master password
Delete crash dumps (depends on your OS, on Windows at least C:\Windows\memory.dmp, but maybe there are others)
Delete hibernation file
Delete pagefile/swapfile (can be quite annoying, don’t forget to enable it back again)
Overwrite deleted data on the HDD to prevent carving (e.g. Cipher with /w on Windows)
Restart your computer